Red Hat has identified and disclosed a significant privilege escalation flaw, labeled CVE-2026-10090, impacting the Application Subscription controller within Red Hat Advanced Cluster Management for Kubernetes (ACM) This article explores cluster admin rights. . This critical vulnerability is rated Important with a CVSS score of 9.9, enabling users possessing only namespace-scoped "edit" permissions on an ACM hub to escalate privileges and gain full cluster-admin rights.
The flaw was documented in Bugzilla entry 2483292 and is considered particularly severe due to its direct violation of ACM's security model, which specifies that non-subscription-admin users should not be able to deploy resources into their own subscription namespace.
Organizations that depend on ACM to enforce multi-tenant separation across managed clusters might inadvertently expose every cluster to takeover by any user with edit-level access to a single namespace, often granted broadly to developers and teams. Given ACM’s widespread deployment in enterprise and government environments for centralized management of OpenShift and Kubernetes clusters, successful exploitation could extend far beyond a single namespace, allowing attackers to read secrets, modify workloads, or pivot into every cluster registered with that hub. Until an official patch or errata is released, security teams should audit who holds namespace-scoped edit access on ACM hub namespaces, closely monitor unauthorized Helm repository references in Channel and Subscription resources, and strictly restrict subscription-admin privileges to trusted operators.
